In August, business groups around the world petitioned China to rethink a proposed cybersecurity law that they said would hurt foreign companies and further separate the country from the internet.
On Monday, China passed that law — a sign that when it comes to the internet, China will go its own way.
The new rules, which were approved by the country’s rubber-stamp Parliament and will go into effect next summer, are part of a broader effort to better define how the internet is managed inside China’s borders.
Officials say the rules will help stop cyberattacks and help prevent acts of terrorism, while critics say they will further erode internet freedom. Business groups worry that parts of the law — such as required security checks on companies in industries like finance and communications, and mandatory in-country data storage — will make foreign operations more expensive or lock them out altogether. Individual users will have to register their real names to use messaging services in China.
Restrictions on the flow of data across borders “provide no security benefits but will create barriers to Chinese as well as foreign companies operating in industries where data needs to be shared internationally,” James Zimmerman, chairman of the American Chamber of Commerce in China, wrote in an emailed statement.
He added that by creating such restrictions, China risked isolating itself technologically from the rest of the world.
But in many ways, the regulations are not likely to have a major impact on much about how business is done. Most of the rules are already in effect, but not codified. Other parts are vague enough that the government will determine their meaning on the fly.
The law, however, is an important statement from Beijing on how the internet should be run: with tighter controls over companies and better tracking of individual citizens.
Calling it a “basic law,” Chen Jihong, a partner at the Zhong Lun law firm in Beijing, said the rules were set up to deal with the growing number of legal issues regarding the Chinese internet and to seek to strike a balance between privacy and security.
“The law only stipulates principles; it would take follow-up laws or interpretations to specify the standards,” he said.
